Your data, your choice.

Luma is made by Rootlex Technologies Private Limited (“we”, “us”). We are responsible for the information described here. You can reach us at luma-support@rootlex.com.

This policy covers the Luma app, its Share Extension and widget, and this website.

Luma does its work on your iPhone or iPad. None of the following is sent to us or to anyone else:

• Your photos and videos, and the thumbnails, hashes and similarity data Luma computes to find duplicates.
• Files in Luma Storage, files you share into Luma, and folders you link through the Files picker.
• File names, and text Luma reads from screenshots, scans and PDFs.
• Questions you ask your documents. Luma answers them with Apple’s on-device model, and the document stays on the device.
• The Private Vault. Its files are encrypted on the device, and the key is kept in the device’s Keychain.
• Your cleanup history and storage totals, which power the success screens, streaks and widget.
• The Spotlight index, if you turn on Show Luma Storage in Search. It holds Luma Storage file names only. Never contents, Vault files or linked folders.

Encrypted backups are files that you create and keep. They are protected with your password, and we never receive them. Keep the password safe: we can’t recover it.

Each permission is optional, and Luma explains why before iOS asks. You can change them in iOS Settings.

• Photos, full or limited, to find duplicates, large videos and screenshots. Luma deletes a photo only after you confirm, and Photos asks you again.
• Camera, to scan documents into Luma Storage.
• Face ID, to unlock the Private Vault.
• Notifications, for the optional weekly report and reminders. These are created on the device, not sent by a server.

Luma cannot read the rest of your phone or another app’s storage. Content from apps like WhatsApp, Mail, Safari or Messages reaches Luma only when you share it to Luma yourself.

In the current version, nothing. Luma does not contact our servers. It has no account, no sign-in, and no analytics unless you are offered the switch below and turn it on.

The app contains two optional features that are switched off in this version. We describe them here so you know what they would send if we turn them on. We’ll update this policy, and the date at the top, before either becomes available.

Anonymous usage analytics (off unless you turn it on). When offered, a Share anonymous usage switch appears during setup and in Settings. If you turn it on, Luma would send:

• event names from a fixed list, such as “onboarding completed”;
• the day each event happened (no time of day);
• the app version;
• a random analytics ID that Luma creates and replaces whenever you turn sharing off.

It would never include photos, files, file names, text, contacts or device identifiers. Turning sharing off deletes any events not yet sent.

Invite friends. When offered, giving a friend your invite code would store on our referral service a random install ID created by Luma, your code, when it was redeemed, and a one-way hash of the App Store’s app transaction ID (Apple’s signed proof that the app came from the App Store). We would keep only the hash, which can’t be turned back into the ID.

Network addresses. If either feature is turned on, its requests would reveal your device’s IP address to our hosting provider, like any internet request. Our service keeps only a one-way hash of the address (for IPv6, of its network prefix), to limit how many requests a network can make. It would not store the address itself.

None of this would be linked to your identity or used to track you across apps or websites.

Luma is free and has no in-app purchases, so we never receive payment details. If we add paid features in a future version, Apple would process the payment through the App Store, we would still not receive your name, email or card details, and we would update this policy first.

If you choose to share analytics with app developers in iOS Settings, Apple gives us crash reports and aggregated usage statistics, such as installs and sessions. Apple controls that sharing, and you can turn it off under Settings → Privacy & Security → Analytics & Improvements.

• We don’t sell or rent information, and we don’t use it for advertising.
• We don’t track you across other companies’ apps or websites.
• Luma contains no third-party advertising, analytics or tracking SDKs.
• Luma has no accounts, so we don’t ask for your name, email or phone number.

We share the limited information in section 4 only:

• with the infrastructure provider that hosts our services (Cloudflare), which processes it on our behalf. Its servers may be outside your country;
• when the law requires it, or to protect the rights, safety and security of our users and of Luma;
• with a successor, if Luma is sold or merged, bound by this policy.

• Content on your device stays until you delete it. Files you remove sit in Luma’s Recently Deleted for 30 days unless you empty it sooner. Deleting the app removes Luma Storage and the Vault from the device.
• We hold nothing from the current version, because it sends nothing. If the optional features in section 4 are turned on, usage events would be kept only as long as we need them to understand how Luma is used, and referral records while Invite friends is offered.

• Change or revoke Photos, Camera, Face ID and notification access in iOS Settings.
• When usage sharing is offered, turn it on or off at any time in Luma → You → Usage analytics.
• Delete files in Luma, or delete the app to remove everything it stored on the device.

Depending on where you live, including under the GDPR, UK GDPR, India’s Digital Personal Data Protection Act and US state privacy laws, you may have the right to access, correct or delete personal data, to object to or restrict processing, to withdraw consent, and to complain to your data protection authority. Write to luma-support@rootlex.com and we’ll respond within the time the law requires.

Because nothing we might receive is linked to your identity, we may not be able to find records that belong to you.

Where the GDPR or similar laws apply: the current version processes personal data only on your device, to provide the features you use. If the optional features in section 4 are turned on, usage analytics would rest on your consent, which you can withdraw at any time, and referral requests on providing the feature and our legitimate interest in preventing abuse.

Luma is not directed at children under 13, or the minimum age in your country. We don’t knowingly collect personal information from children. If you believe a child has sent us information, contact us and we’ll delete it.

The Vault and encrypted backups use AES-256-GCM, with keys that stay on your device or derive from your password. Our services accept only encrypted (HTTPS) connections, store hashes instead of raw identifiers, and limit request rates. No system is perfectly secure, but we design Luma so that there is very little to expose.

We’ll update this page when Luma changes what it collects, and change the date at the top. If a change matters, for example a new kind of data, we’ll tell you in the app before it applies.

Rootlex Technologies Private Limited, Flat No. 306, Lansum Eden Gardens, CMC Enclave, Road No. 1, Kondapur, Hyderabad, Telangana 500084, India. luma-support@rootlex.com